Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Winfixer & popups [RESOLVED]

mpl

Posted 08 August 2005 - 09:13 AM

mpl

Member

Member

23 posts

Hi All,

Im having a terriable time with Winfixer & a lot of other popups comming from nowwhere. I've run all the spy killer and virus stuff but cant get rid if it. I've even tried a number of procedures from this and other forums.... Still got it...

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Double click WinPFind.exe

* Click 'Start Scan'* It will scan the entire system, so please be patient!* Once the scan is complete:1. Go to the WinPFind folder2. Locate WinPFind.txt3. Copy those results in the next post!

Reboot back to Normal Mode!

Double click on 'Track qoo.vbs'

Note - If you have an anti-virus program that has script blocking features, you will get a pop up window asking you what to do. Allow this entire script to run. It's harmless.

Wait a few seconds and Notepad will pop up. Copy & Paste those results and place them in the next post along with the results of WinPFind!

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing Enter. This will scan your computer and it may appear nothing is happening. After a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 or any other files in the l2mfix folder until you are asked to do so!

mpl

Posted 08 August 2005 - 01:17 PM

When attempting to run Track qoo 1.vbs I recived a failure which I posted below.

Here's the WinPFind.txt file

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

greyknight17

Posted 08 August 2005 - 01:53 PM

greyknight17

Malware Expert

Visiting Consultant

16,560 posts

Do this now if you can before posting Trackqoo:

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing Enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2MFix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new HijackThis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

greyknight17

Posted 08 August 2005 - 02:07 PM

greyknight17

Malware Expert

Visiting Consultant

16,560 posts

OK, I ran into these before but forgot exactly what I did in the past (or if I figured a way out at all). I have asked other staff members to help assist me on this one. And as soon as they reply, I will get back to you.

Meanwhile, try running L2MFix and post that log along with a HijackThis log.

Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. ****************************************************************************REGEDIT4

mpl

Posted 08 August 2005 - 07:44 PM

mpl

Member

Topic Starter

Member

23 posts

Kevin,

Regarding Trackqoo

I tried running it in safe mode & normal mode with the Antispyware turned off. I also re-downloaded it serverl times. I get the same error. Also just to let you know I had to restore the following C:\windows\system32\config.nt, autoexec.nt, & command.com from the cd so I could run dos programs. (I may have dusted off some legit files with edwido over the weekend.)